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Abstract. For infinitely many primes p = Ak+1 we give a slightly 
improved upper bound for the maximal cardinality of a set B Glip 
such that the difference set B — B contains only quadratic residues. 
Namely, instead of the "trivial" bound < ^Jp we prove |J5| < 
^Jp — 1, under suitable conditions on p. The new bound is valid 
for approximately three quarters of the primes p = 4fc + 1 . 
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1. INTRODUCTION 

Let g be a prime-power, say q = . We will be interested in es- 
timating the maximal cardinality s{q) of a set -B C such that the 
difference set B — B contains only squares. While our main interest is 
in the case A; = 1, we find it instructive to compare the situation for 
different values of k. 

This problem makes sense only if —1 is a square; to ensure this 
we assume q = 1 (mod 4). The universal upper bound s(g) < ^/q 
can be proved by a pigeonhole argument or by simple Fourier anlysis, 
and it has been re-discovered several times (see O Theorem 3.9], [TT| 
Problem 13.13], [3l Proposition 4.7], [21 Chapter XIII, Theorem 14], 
[I0| Theorem 31.3], [9l Proposition 4.5], [Gj Section 2.8] for various 
proofs) . For even k we have equality, since F^*: can be constructed as a 
quadratic extension of Wpk/2, and then every element of the embedded 
field Fpfc/2 will be a square. It is known that every case of equality can 
be obtained by a linear transformation from this one, [T] . 

Such problems and results are often formulated in terms of the Paley 
graph Pg, which is the graph with vertex set Fg and an edge between 
X and y if and only if x — y = for some non-zero a G Fg. 
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Paley graphs are self-complementary, vertex and edge transitive, and 
(g, (g — l)/2, (g — 5)/4, (g — l)/4)-strongly regular (see [2] for these and 
other basic properties of Pq). Paley graphs have received considerable 
attention over the past decades because they exhibit many properties 
of random graphs G{q, 1/2) where each edge is present with probability 
1/2. Indeed, Pq form a family of quasi-random graphs, as shown in [1]. 

With this terminology s{q) is the clique number of Pq. The general 
lower bound s(g) > (| + o(l))log2g is established in [5], while it is 
proved in [8] that s{p) > c log p log log log p for infinitely many primes 
p. The "trivial" upper bound s{p) < ^/p is notoriously difficult to 
improve, and it is mentioned explicitly in the selected list of problems 
[6]. The only improvement we are aware of concerns the special case 
p = 77,^ + 1 for which it is proved in [12] that s{p) < n — 1 (the same 
result was proved independently by T. Sanders - unpublished, personal 
communication). It is more likely, heuristically, that the lower bound 
is closer to the truth than the upper bound. Numerical data [151 111] 
up to p < 10000 suggest (very tentatively) that the correct order of 
magnitude for the clique number of Pp is clog^p (see the discussion 
and the plot of the function s{p) at [TB]). 

In this note we prove the slightly improved upper bound s{p) < 
y/p — 1 for the majority of the primes p = Ak + l (we will often suppress 
the dependence on p, and just write s instead of s{p)). 

We will denote the set of nonzero quadratic residues by Q, and that 
of nonzero non-residues by NQ. Note that ^ Q and ^ NQ. 



Theorem 2.1. Let q be a prime-power, q = p^ , and assume that k is 
odd and q = 1 (mod 4). Let s = s{q) be the maximal cardinality of a 
set B cWg such that the difference set B — B contains only squares. 



2. The improved upper bound 




D C NQ, D-D C gu{0}. 



With r 



D\ we have 



(1) 



s{q) < 1 + 



g-1 



2r 
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Proof. Let i? be a maximal set such that B — B C Q {0}, \B\ ~ 
s{q) — s. Consider the equation 

fei - 62 = zd, bi,b2 e B, de D, z e NQ. 

This equation has exactly s{s — l)r solutions; indeed, every pair of 
distinct 61, &2 £ B and a d & D determines z uniquely. On the other 

hand, given bi and z, there can be at most one pair 62 and d to form a 
solution. Indeed, if there were another pair 63, d', then by substracting 
the equations 

bi — b2 — zd, fci — &2 — 
we get (62 — ^2) = z{d — d'), a contradiction, as the left hand side is a 
square and the right hand side is not. This gives s{s — l)r < s{q — l)/2 
as wanted. □ 

We try to construct such a set D in the form D = {B — t)r\ NQ with 
a suitable t. The required property then follows from D — D C B — B. 

Let X denote the quadratic multiplicative character, i.e. x(t) = ±1 
according to whether t E Q or t e NQ (and x(0) = 0). Let 

(2) ^{t) = J2x{b-t). 

beB 

Clearly 

<p{t) ^\{B-t)nQ\-\{B-t)n NQl 

and hence ior t ^ B we have 

|(B-t)niVQ| = iZ|W. 

To find a large set in this form we need to find a negative value of ip. 

We list some properties of this function. For t e B we have ip{t) — 
s — 1, and otherwise 

ip{t) < s - 2, ip{t) = s (mod 2) 

(the inequality expresses the maximality of B). Furthermore, 

t 

and, since translations of the quadratic character have the quasi-orthogonality 
property 

Y,x{t + 0')x{t + b)^-l 
t 

for a 7^ 6, we conclude 

J2 ^{tf = s{q - 1) - s{s - 1) = s{q - s). 
t 
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By substracting the contribution of t E B we obtain 

ipitf = s{q - s) - s{s - \f = s(g - + s - 1). 

t(^B 

These formulas assume an even nicer form by introducing the func- 
tion = ip{t) + 1: 

(3) J](^i(t) = g-s2, 

t(^B 

(4) ^^i(t)^ = (. + l)(g-.2). 

t^B 

As a byproduct, the second equation shows the famihar estimate s < 
y/q, so we have s = [y/q] < ^/q (recall that we assume that s > [^/q], 
the theorem being trivial otherwise). 

Now we consider separately the cases of odd and even s. If s is even, 
then, since Ylt^sfi^) ^ ^ each summand is even, we can find a 
t with ip{t) < —2. This gives us an r with r > (s + 2)/2, and on 
substituting this into ([1]) we obtain the first case of the theorem. 

If s is odd, we claim that there is a t with (p{t) < —3. Otherwise 
we have ip(t) > —1, that is, ipi(t) > for all t ^ B. We also know 
(pit) < s — 2, (flit) < s — 1 ioT t ^ B . Consequently 

ti^B t(^B 

a contradiction to (jlj). (Observe that to reach a contradiction we need 
that g — is strictly positive. In case of an even k it can happen that 
q = and the function ipi vanishes outside B.) 

This t provides us with a set D with r > (s+3)/2, and on substituting 
this into ([1]) we obtain the second case of the theorem. □ 

Remark 2.3. An alternative proof for the case q = p and s being 
odd is as follows. Assume by contradiction that ipi is even-valued and 
nonnegative. Then by ([3]) it must be for at least 

q — s"^ q + s"^ — 2s 



values of t. Let X; V^; V^i denote the images of x, ^, in '^q (i-e. the 
functions are evaluated mod p). By the previous observation ipi has 
at least (g + s^ — 2s)/2 zeroes. On the other hand, we have xi^) = , 
and hence is a polynomial of degree (g — l)/2; its leading coefficient 
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is s = [y^] 7^ mod p (This last fact may fail if g = p^, even if k is 
odd. Therefore this proof is restricted in its generality. Nevertheless we 
include it here, because we believe that it has the potential to lead to 
stronger results if g = p.) Consequently ifi can have at most (g — l)/2 
zeros, a contradiction. In the case of even k we can have s = ^Jq = 
(mod p) and so the polynomial ipi can vanish, as it indeed does when 
5 is a subfield. 

Remark 2.4. It is clear from ([1]) that any improved lower bound on r 
will lead to an improved upper bound on s. If one thinks of elements of 
Zp as being quadratic residues randomly with probability 1/2, then we 
expect that r > l+c-y/i. This would lead to an estimate s < y/p—cp^^^. 
This seems to be the limit of this method. In order to get an improved 
lower bound on r one can try to prove non-trivial upper bounds on 
the third moment J2teZpV^(^)- '^'^ ^'^ ^'^^^j would need that the 
distribution of numbers l^Zll approximately uniform on Q as 6i, 62, &3 
ranges over B. This is plausible because if s ~ ^/p then the distribution 
of B — B must be close to uniform on NQ. However, we could not prove 
anything rigorous in this direction. 

Remark 2.5. Theorem 12.11 gives the bound s < [y^] — 1 for about three 
quarters of the primes p = Ak + 1. Indeed, part (ii) gives this bound 
for almost all p such that n = [^/p] is odd, with the only exception 
when p = {n + 1)^ — 3. Part (i) gives the improved bound s < — 1 if 
n'^ + n — 1 > p. This happens for about half of the primes p such that 
n is even. 
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